What you choose to share
There are three things you can share with Lula's research, and you pick them one at a time. All three are optional. You can change your mind whenever you like.
Your name, email, phone number and date of birth are never shared with researchers, no matter which options you turn on. Sharing nothing at all is a completely normal choice, and Lula works exactly the same either way.
The three things you can share
Each one includes the ones above it. You can stop at any level.
The essentials
The broad shape of who is asking, and what about.
Your age range, where you are in your cycle, and the subjects you ask about — as plain tags, not sentences.
These are stored without your name attached, and counted. They answer questions like “how many women in their forties are asking about sleep?”
Your patterns
How your symptoms move over time. Includes option one.
Symptoms and conditions, and how they change from week to week and cycle to cycle.
This is what builds a real picture of what happens in women's bodies over months rather than moments — the thing most health research is missing.
Your conversations
Whole chats, with every identifying detail removed first. Includes options one and two.
The full back-and-forth of a conversation with Lula — your questions and her answers — after names, places, workplaces, contact details and links have been stripped out.
Every conversation goes through three cleaning passes before it is stored: an automatic scan for contact details, links and numbers; then an AI reader that removes names, places and workplaces; then the automatic scan again to catch anything the second pass introduced. If any pass fails or cannot be checked, nothing is saved at all. The cleaned copy is then stored with no link back to your account.
Conversations you had before you switch this on are never included. It starts from the moment you say yes.
After: “I'm [name], I've been getting these headaches since I started at [workplace] in [place]”
How they stack
They are nested, not separate. This is the part people find surprising.
Turning on a wider option switches on everything above it. Turning off a narrower option switches off everything below it — so switching off the essentials switches off all three.
Opting out
There are several different ways to stop, and they do different things.
Nothing is ever shared. This is the default position if you decline at sign-up, and Lula works exactly as normal.
Sharing stops from that moment. Anything already shared stays in the research set. This is the one to read twice.
Everything you have ever contributed is deleted. Not hidden or marked inactive — deleted, automatically, by the database itself the moment you leave.
Its research copy is deleted with it.
Everything goes, including every research contribution.
Switching an option off stops anything new being shared, but does not remove what is already there. Leaving the programme removes all of it. If your intention is “I want it all gone”, leaving the programme is the one that does that.
Never shared, at any level
These are kept in a separate part of the system that the research side cannot reach.
The two companies Lula works with
This part is different from the three options above, and it is worth understanding why. Lula needs outside help to answer you at all, so these happen for everyone — they are not something you switch on. What follows is exactly what each company receives.
Anthropic — the makers of Claude
Claude is the AI that actually writes Lula's answers. Every question you ask goes to it.
Your question, the conversation so far, and the health details relevant to it — things like your symptoms, your cycle phase, your conditions and medications, and your age range. Plus any research passages Lula has looked up to answer you.
Your name, email, phone number, date of birth or billing details. These are kept in a separate part of the database that the AI is structurally unable to reach, and there is an automatic check that stops the app being released if anyone breaks that rule.
When Lula greets you by name, the app adds that after Claude has written the reply. Claude never saw it.
From Lula's own server, never from your phone directly.
Without it there is no Lula — it is the part that answers you. Turning off all three research options above does not change this, because it is not research: it is the app working.
Collective Health X
A specialist women's health research service. Lula asks it questions and it replies with an answer drawn from published studies, along with the papers it came from — which is how you get citations rather than an AI's best guess.
The wording of your question, and nothing else. No conversation history, no symptoms, no conditions, no medications, no cycle phase, no age, no name. It receives a question the way a librarian would — with no idea who is asking.
Before the question leaves, any email address or phone number in it is automatically replaced with [redacted], and very long questions are trimmed. Dates are deliberately left alone, because cycle dates are usually the point of the question.
An answer and a list of real published papers — title, authors, journal, year — which is what you see when Lula shows her sources.
Quietly in the background, on questions where it is worth looking deeper. You do not have to ask for it.
They receive: “why do I get headaches before my period, email me at [redacted]”
Two honest caveats
Because a privacy page that only lists reassurances is not much of a privacy page.
The three-pass scrub is thorough and it refuses to save anything it cannot verify. But if you write something highly specific and unusual about yourself in your own words, there is always a small residual chance it survives cleaning. If something feels too identifying to write down, trust that instinct.
During the beta, the Lula team reads conversations to find where Lula gets things wrong. That is part of how the beta works, and it is not the same thing as research sharing — turning the three options above off does not switch it off.
Being straight with you about where this stands: today, a conversation the team opens still shows which account it belongs to. We are changing that this week, so that conversations are reviewed under a pseudonym and connecting one back to a real person becomes a separate, deliberate step.
What is already true: every single time anyone on the team opens a conversation, it is recorded — who looked, whose data, and when. That log is built so that nobody can edit or delete an entry, including us. If you ever want to know whether anyone has looked at yours, ask and we will show you.
If anything here is unclear, or you want to see exactly what is stored about you, just ask — we will show you.